<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <parent>
    <groupId>com.atlassian.security</groupId>
    <artifactId>atlassian-security</artifactId>
    <version>4.0.2</version>
  </parent>

  <artifactId>atlassian-secure-xml</artifactId>

  <name>Atlassian Secure XML</name>
  <description>Utility methods to construct parsers suitable for XML from untrusted sources.</description>

  <!-- This must be >= 2.7.1, or nothing (to use the JDK's bundled version)-->
  <properties>
    <test.xml.parser.groupId>xerces</test.xml.parser.groupId>
    <test.xml.parser.artifactId>xercesImpl</test.xml.parser.artifactId>
    <test.xml.parser.version>2.7.1</test.xml.parser.version>
  </properties>

  <dependencies>
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.hamcrest</groupId>
      <artifactId>hamcrest-all</artifactId>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>${test.xml.parser.groupId}</groupId>
      <artifactId>${test.xml.parser.artifactId}</artifactId>
      <version>${test.xml.parser.version}</version>
      <scope>test</scope>
    </dependency>

    <!-- Non-core XML frameworks -->
    <dependency>
      <groupId>xom</groupId>
      <artifactId>xom</artifactId>
      <version>1.2.5</version>
      <optional>true</optional>
      <exclusions>
        <exclusion>
          <groupId>xerces</groupId>
          <artifactId>xmlParserAPIs</artifactId>
        </exclusion>
        <exclusion>
          <groupId>xerces</groupId>
          <artifactId>xercesImpl</artifactId>
        </exclusion>
        <exclusion>
          <groupId>xml-apis</groupId>
          <artifactId>xml-apis</artifactId>
        </exclusion>
        <exclusion>
          <groupId>xalan</groupId>
          <artifactId>xalan</artifactId>
        </exclusion>
        <exclusion>
          <groupId>jdom</groupId>
          <artifactId>jdom</artifactId>
        </exclusion>
      </exclusions>
    </dependency>

    <dependency>
      <groupId>org.jdom</groupId>
      <artifactId>jdom</artifactId>
      <version>1.1.3</version>
      <optional>true</optional>
    </dependency>

    <dependency>
      <groupId>dom4j</groupId>
      <artifactId>dom4j</artifactId>
      <version>1.6.1</version>
      <optional>true</optional>
      <exclusions>
        <exclusion>
          <groupId>xml-apis</groupId>
          <artifactId>xml-apis</artifactId>
        </exclusion>
      </exclusions>
    </dependency>

    <dependency>
      <!--
      We're explicitly pulling a newer version of commons-beanutils, because the one
      used by the latest version of commons-digester (1.8.3) is vulnerable to
      * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0114
      * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10086
      Commons-digester has since been replaced by commons-digester3, but that's a bigger
      change, unnecessary for the moment.
      -->
      <groupId>commons-beanutils</groupId>
      <artifactId>commons-beanutils</artifactId>
      <version>1.9.4</version>
      <optional>true</optional>
    </dependency>
    <dependency>
      <groupId>commons-digester</groupId>
      <artifactId>commons-digester</artifactId>
      <version>2.1</version>
      <optional>true</optional>
      <exclusions>
        <exclusion>
          <groupId>xml-apis</groupId>
          <artifactId>xml-apis</artifactId>
        </exclusion>
        <exclusion>
          <groupId>commons-beanutils</groupId>
          <artifactId>commons-beanutils</artifactId>
        </exclusion>
      </exclusions>
    </dependency>
  </dependencies>
</project>
